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A  central  goal  of  quantum  information  science  is  to  transfer  quantum  states 
with  high  fidelity,  efficiency,  and  speed.  While  the  majority  of  quantum  com¬ 
munications  uses  photons  encoded  in  binary  quantum  states,  it  has  recently 
been  shown  that  high-dimensionally  encoded  states  can  provide  significant  ad¬ 
vantages  in  applications  such  as  quantum  metrology  and  quantum  commu¬ 
nication.  In  particular,  high-dimensional  quantum  key  distribution  enables 
higher  secret-key  generation  rates  under  practical  limitations  of  detectors  or 
light  sources,  as  well  as  greater  error  tolerance.  Here,  we  demonstrate  the  first 
high-dimensional  quantum  key  distribution  field  test,  using  photons  encoded 
in  a  high-dimensional  alphabet  to  increase  the  secure  information  yield  per  de- 
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tected  photon.  By  adjusting  the  alphabet  size,  it  is  possible  to  optimize  secret- 
key  rate  for  different  channel  loss  scenarios.  These  demonstrations  enable 
record  quantum  secure  communication  rates  over  metro-scale  distances  and 
mark  an  important  step  toward  high-speed  transmission  of  high-dimensional 
quantum  states  in  deployed  fiber  networks. 

Introduction 

Quantum  key  distribution  (QKD)  allows  two  parties,  Alice  and  Bob,  to  establish  provably  se¬ 
cure  encryption  keys  at  a  distance.  The  keys  can  be  used  with  encryption  schemes  like  the 
one-time  pad  (OTP),  which  requires  no  assumptions  about  the  computational  abilities  of  an 
adversary.  QKD  commonly  relies  on  the  transmission  and  detection  of  single  photons  to  dis¬ 
tribute  the  secret  keys,  but  the  secret-key  generation  rates  are  often  limited  by  the  receiver 
hardware,  which  caps  the  achievable  photon  detection  rate  (1).  Under  this  constraint,  for  a 
given  maximum  detection  rate,  the  secret-key  rate  can  still  be  raised  by  optimizing  the  photonic 
encoding.  The  first  QKD  schemes  used  photons  encoded  in  two  states,  such  as  two  different 
polarization  states  (2,  3).  Recently,  much  effort  has  turned  to  large-alphabet  QKD  schemes, 
which  encode  photons  in  a  larger  set  of  high-dimensional  basis  states  (4-12).  Compared  to 
binary-encoded  QKD,  such  large-alphabet  schemes  can  encode  more  secure  information  per 
detected  photon,  boosting  secure  communication  rates,  and  also  provide  increased  resilience 
to  noise  and  loss  (13).  High-dimensional  encoding  may  also  improve  the  efficiency  of  quan¬ 
tum  sensing  (14)  and  other  tasks  in  quantum  information  processing,  such  as  performing  Bell 
tests  (15)  and  implementing  quantum  gates  (16).  We  take  advantage  of  high-dimensional  en¬ 
coding  to  demonstrate  a  record  QKD  rate  for  three  different  channel  losses  using  a  prepare- 
and-measure  high-speed,  large-alphabet  QKD  protocol,  including  the  first  field  demonstration 
of  large-alphabet  QKD  in  a  deployed-fiber  testbed. 
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High-dimensional  encoding  is  possible  in  a  variety  of  degrees  of  freedom,  and  large-alphabet 
QKD  has  been  demonstrated  in  the  laboratory  using  position-momentum  (5),  time-energy  (5, 
6,  9-11),  and  orbital  angular  momentum  modes  (7,  12).  Of  these,  time-energy  encoding  is 
appealing  for  its  compatibility  with  existing  telecommunications  infrastructure  —  which  low¬ 
ers  the  barriers  to  widespread  adoption  of  QKD.  The  time-energy  correlations  are  robust  over 
transmission  in  both  fiber  and  free-space  channels  and  are  preserved  when  passing  through 
wavelength-division  multiplexing . 

In  high-dimensional  temporal  encoding,  the  position  of  a  photon  within  a  symbol  frame 
comprising  M  time  slots  can  convey  as  much  as  log2  M  bits  of  information,  as  depicted  in 
Figure  1(a).  Classically,  this  encoding  is  known  as  pulse  position  modulation  (PPM),  and  com¬ 
bined  with  single-photon  detection,  it  achieves  near-optimal  performance  in  terms  of  bits  per 
detected  photon  (17).  Assuming  a  constant  slot  duration,  PPM  exhibits  a  trade-off  between  the 
alphabet  size  M  and  the  transmitted  symbol  rate:  an  increase  in  the  former  directly  corresponds 
to  a  decrease  in  the  latter.  The  alphabet  size  determines  how  much  information  is  encoded  in 
each  photon,  and  the  transmitted  symbol  rate  directly  affects  how  many  photons  are  received 
per  second.  We  take  advantage  of  this  trade-off  to  maximize  the  secret-key  rate  in  the  presence 
of  receiver  saturation. 

Figure  1(b)  is  a  representative  plot  of  secret-key  rate  versus  channel  length  for  binary  en¬ 
coding  with  realizable  parameters.  Three  regimes  of  distance/loss  are  indicated.  In  normal  op¬ 
eration  (Region  II),  the  secret-key  rate  decreases  exponentially  with  distance  until  the  received 
photon  flux  is  comparable  to  the  background  counts  of  the  detector(s).  At  distances/losses  be¬ 
yond  this  cutoff  point  (Region  III),  the  correlations  between  sender  and  receiver  are  masked  by 
the  background  and  the  secret-key  rate  drops  abruptly.  However,  at  short  distances,  i.e.,  low 
losses  (Region  I),  the  secret-key  rate  is  limited  when  some  component  of  the  receiver  hardware 
—  such  as  the  detectors  or  the  readout  electronics  —  is  saturated  by  the  incoming  photon  flux, 
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as  illustrated  in  Figure  1(b).  In  this  regime,  which  extends  to  approximately  100  km  for  these 
parameters,  the  best  strategy  to  maximize  the  secret-key  rate  is  to  reduce  the  transmitted  pho¬ 
ton  rate  by  increasing  the  alphabet  size  until  the  receiver  is  just  below  saturation.  Although 
much  research  has  focused  on  extending  the  range  of  QKD  links  well  beyond  100  km  (18-21), 
deployed  QKD  networks  will  include  a  variety  of  link  lengths  with  potentially  different  op¬ 
timal  technologies,  and  thus  we  focus  here  on  using  high-dimensional  encoding  to  maximize 
secret-key  rates  over  metropolitan-area  distances  of  tens  of  kilometers. 

Results 

To  demonstrate  high-rate,  large-alphabet  QKD,  we  implemented  dispersive-optics  QKD  (DO- 
QKD)  (22),  a  high-dimensional  QKD  protocol  based  on  time-energy  encoding,  with  the  basis 
transformations  produced  by  group  velocity  dispersion  (GVD).  We  previously  proved  the  se¬ 
curity  of  this  scheme  against  arbitrary  collective  attacks  (22)  and  implemented  the  scheme  us¬ 
ing  entangled  photon  pairs  in  the  laboratory  (10).  The  present  work  is  a  prepare-and-measure 
(P&M)  version  of  DO-QKD,  with  decoy-state  protection  against  photon  number  splitting  at¬ 
tacks  (23-25). 

In  P&M  DO-QKD,  as  pictured  in  Figure  2,  the  transmitter,  Alice,  filters  a  broadband  light 
source  to  ~  25  GHz  centered  at  1559  nm  and  uses  an  electro-optic  modulator  to  encode  a 
PPM  sequence  that  will  become  the  raw  key.  To  prepare  in  the  time  basis,  Alice  sends  the 
PPM  pulse  to  the  receiver,  Bob,  and  to  prepare  in  the  energy  basis,  she  applies  normal  GVD 
with  magnitude  10,000  ps/nm  to  the  pulse  before  sending  it  to  Bob.  The  basis  choice  must 
be  random  to  an  eavesdropper,  Eve,  but  known  to  Alice.  Before  transmitting,  Alice  attenuates 
the  pulses  to  keep  the  average  number  of  photons  less  than  one  per  pulse,  but  she  varies  the 
intensity  between  signal  states,  which  are  used  for  generating  secure  keys,  and  weaker  decoy 
states,  which  are  used  for  channel  monitoring  to  guard  against  a  photon-number-splitting  attack. 
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Alice  also  precompensates  for  the  GVD  incurred  over  the  fiber  channel,  or  the  security  of  the 
protocol  would  be  degraded.  On  a  separate  channel  (not  pictured  in  Figure  2),  Alice  sends  a 
periodic,  bright  optical  pulse  that  Bob  detects  with  a  photodiode  and  uses  as  a  timing  reference. 
To  measure  in  the  time  basis.  Bob  detects  the  photon  arrival  time,  and  to  measure  in  the  energy 
basis,  he  applies  anomalous  GVD  with  magnitude  10,000  ps/nm  to  the  photon  before  detecting 
the  arrival  time.  Bob’s  single-photon  detectors  are  niobium  nitride  (NbN)  SNSPDs  capable  of 
counting  at  hundreds  of  Mcps  rates,  with  68%  detection  efficiency,  timing  resolution  of  tens 
of  picoseconds,  and  few  kcps  dark  count  rates  (26).  A  single  optical  fiber  is  coupled  to  four 
interleaved  nanowires,  which  are  read  out  by  a  commercial  time-to-digital  converter  (Picoquant 
Hydraharp  400)  with  a  80  ns  dead  time  per  channel.  Information  can  be  shared  when  Alice 
and  Bob  both  apply  GVD  or  both  do  not  apply  GVD.  When  only  one  party  applies  GVD, 
the  correlation  between  prepared  pulse  time  and  measured  pulse  time  is  degraded  from  tens 
of  picoseconds  (limited  by  the  detector  timing  resolution)  to  nanoseconds  (determined  by  the 
optical  bandwidth  and  the  magnitude  of  the  GVD).  After  the  photon  timetags  are  recorded, 
Alice  and  Bob  convert  the  photon  timing  correlations  into  shared  secret  keys  through  a  series 
of  classical  postprocessing  steps.  Bob  demodulates  the  PPM  signal,  and  Alice  and  Bob  sift 
their  data  to  postselect  symbols  encoded  and  decoded  using  the  same  basis.  They  correct  errors 
between  their  symbol  strings  using  a  multi-layer  low-density  parity-check  (LDPC)  code  (27), 
and  they  perform  privacy  amplification  to  eliminate  Eve’s  information  about  their  shared  error- 
free  symbol  strings. 

The  secure  photon  information  efficiency  (PIE)  quantifies  Alice  and  Bob’s  information  ad¬ 
vantage  over  Eve,  who  can  mount  arbitrary  collective  attacks.  In  the  asymptotic  regime,  the 
secure  PIE  for  DO-QKD  with  decoy-state  analysis  is 

roc, decoy  =  B)  -  (1  -  F JB)  log2  M  -  FBBXUB(A;  E ),  (1) 
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where  /3I(A ;  B)  is  Alice  and  Bob’s  reconciled  mutual  information,  FBB  is  a  lower  bound  on 
the  fraction  of  Bob’s  detection  events  that  came  from  a  single-photon  transmission  by  Alice, 
and  xUH(/l;  E)  is  an  upper  bound  on  Eve’s  Holevo  information  (22,  25,  28).  By  measuring 
the  covariance  matrix  associated  with  the  correlation  between  prepared  pulse  time  and  mea¬ 
sured  pulse  time  (22, 28)  and  by  monitoring  the  quantum  channel  using  weak-intensity  decoy 
states  (23-25),  Alice  and  Bob  can  bound  ;\/UB  (A:  E),  the  information  accessible  to  Eve.  Any 
information  that  Alice  and  Bob  share  in  excess  of  this  bound  will  be  secure,  except  with  a  finite 
failure  probability  that  corresponds  to  the  predetermined  security  parameter  es  (29-32). 

Decoy  state  measurements  contribute  to  the  estimation  of  FBB  and  ;\/UH(/l;  E).  In  the  finite- 
key  regime,  we  must  consider  the  effects  of  a  finite  sample  size  on  the  estimation  of  the  pa¬ 
rameters  related  to  decoy  states  (32),  in  addition  to  the  standard  finite-size  effects  on  parameter 
estimation,  error  correction,  and  privacy  amplification  (31). 

We  tested  the  system,  varying  the  PPM  alphabet  size  M  e  (4,  8, 16,  32},  in  three  scenar¬ 
ios:  in  the  laboratory  in  the  back-to-back  configuration  with  negligible  channel  loss,  in  the 
laboratory  using  a  41 -km  spool  of  standard  single-mode  fiber,  and  in  a  field  test  over  a  43-km 
deployed  fiber.  The  deployed-fiber  testbed  comprised  a  pair  of  dark  fibers  running  between 
the  main  campus  of  MIT  in  Cambridge,  MA,  and  MIT  Lincoln  Laboratory  in  Lexington,  MA, 
as  illustrated  in  Ligure  2.  Installed  fibers  are  subject  to  environmental  perturbations,  such  as 
temperature  fluctuations,  that  are  not  present  in  the  laboratory,  as  well  as  higher  losses  due  to 
greater  numbers  of  splices  and  bends.  The  41 -km  fiber  spool  had  a  total  loss  of  7.6  dB,  but  the 
loss  over  the  deployed  fiber  was  12.7  dB  —  equivalent  to  63.5  km  of  standard  single-mode  fiber 
on  a  spool  (assuming  standard  loss  of  0.2  dB/km). 

In  the  back-to-back  configuration,  we  observed  a  maximum  secret-key  rate  of  23  Mbps 
with  M  —  16.  Over  the  41 -km  fiber  spool,  the  maximum  secret-key  rate  was  5.3  Mbps  with 
M  —  8.  Over  the  43-km  deployed  fiber,  the  maximum  secret-key  rate  was  1.2  Mbps  with 
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M  =  4.  Table  1  summarizes  the  three  test  cases,  and  Figure  3(a)  plots  the  experimental  results 
along  with  theoretical  secret-key  rates  as  functions  of  channel  loss.  The  reported  values  and 
theoretical  curves  include  decoy  state  and  finite -key  analysis  with  sample  size  N  =  109  counts 
and  security  parameter  es  =  10~10  (31,  32).  Colors  correspond  to  alphabet  size  and  thus  to  test 
configuration,  since  each  configuration  had  a  different  optimal  alphabet  size.  The  theoretical 
curves  were  computed  using  the  experimental  conditions,  such  as  detector  timing  jitter  and  the 
measured  timing  correlations,  which  were  not  the  same  for  all  three  test  configurations.  Thus, 
we  cannot  directly  compare  the  three  curves  to  determine  the  universally  optimal  alphabet  size 
for  a  given  loss.  Instead,  Figure  3(b)  displays  the  secret-key  rates  obtained  for  each  alphabet 
size  in  the  three  test  cases. 

The  optimal  M  to  maximize  the  secret-key  rate  depends  most  strongly  on  Bob’s  received 
photon  rate,  which  is  in  turn  a  function  of  channel  loss.  If  Bob  had  an  ideal  receiver,  the  highest 
secret-key  rate  would  be  obtained  for  the  fastest  transmitter  rate,  which  occurs  for  M  —  2. 
However,  Bob’s  receiver  hardware  is  usually  rate-limited.  The  limit  may  be  due  to  the  single¬ 
photon  detectors  themselves;  for  instance,  SNSPDs  exhibit  reset  times  ranging  from  a  few 
nanoseconds  (26,  33-35)  to  several  tens  of  nanoseconds  (35-37),  depending  on  the  choice  of 
superconductor.  The  detector  readout  electronics  can  also  limit  the  receiver  count  rate,  as  is 
the  case  for  the  commercial  time-tagger  in  our  system.  When  Bob’s  receivable  photon  rate 
is  limited,  increasing  M  >  2  allows  Alice  and  Bob  to  effectively  produce  secret  keys  even 
during  the  reset  time.  Thus,  at  short  distances  and  correspondingly  low  losses,  we  can  expect 
a  bottleneck  due  to  the  maximum  count  rate  of  Bob’s  receiver.  In  this  receiver-limited  regime, 
it  is  advantageous  to  increase  M  to  encode  as  much  information  as  possible  in  each  detected 
photon  while  keeping  the  receiver  just  below  saturation,  and  indeed,  Figure  3(b)  demonstrates 
that  the  optimal  M  decreases  as  channel  loss  increases. 

Our  measurements  do  not  consider  the  case  when  M  —  2  because  DO-QKD  is  not  op- 
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timal  when  M  —  2.  The  secure  PIE  presented  in  Eq.  1  holds  only  against  the  class  of  col¬ 
lective  attacks,  whereas  traditional,  two-dimensional  protocols  such  as  the  Bennett-Brassard 
1984  (BB84)  protocol  (2)  have  proven  security  against  the  most  general,  coherent  attacks  (38). 
Futhermore,  Eq.  1  tends  to  yield  a  lower  secure  PIE  than  that  afforded  by  BB84.  Ref  (38).  the 
highest-rate  BB84  demonstration  for  which  secure  PIE  data  is  available,  obtained  0.26  bit/photon 
with  10  dB  channel  loss.  At  the  same  loss,  a  numerical  simulation  shows  that  P&M  DO-QKD 
with  M  —  2  achieves  a  secure  PIE  of  0.16  bit/photon.  The  numerical  simulation  uses  the 
measured  parameters  (e.g.,  Alice  and  Bob’s  timing  correlations,  detector  timing  jitter)  of  the 
deployed- fiber  test  case.  Over  the  deployed  fiber  with  12.7  dB  loss,  DO-QKD  with  M  —  2 
should  achieve  a  secret-key  rate  of  605  kbps,  indicating  that  increasing  M  provides  a  boost  in 
the  secret-key  rate. 

Discussion 

The  1 .2  Mbps  secret-key  rate  over  the  deployed  fiber  is  the  highest  rate  reported  to  date  in  a 
QKD  field  test  and  also  compares  favorably  to  previously  published  high-rate  laboratory  demon¬ 
strations  under  similar  losses  (1,  38).  Additionally,  Figure  4  plots  our  results  along  with  a  variety 
of  notable  QKD  experiments  ( 1 , 11,  20,  39-41).  Our  results  show  an  improvement  over  other 
works  for  channel  losses  in  the  range  of  0-15  dB.  Our  secret-key  rate  advantage  comes  from 
both  the  high-dimensional  QKD  protocol,  which  effectively  generates  secure  information  even 
during  the  receiver’s  dead  time,  taking  advantage  of  what  would  be  wasted  time  for  traditional 
two-dimensional  protocols.  A  slower  receiver  would  amplify  the  inherent  advantage  of  the 
high-dimensional  protocol,  as  saturation  would  occur  at  lower  incoming  photon  rates. 

The  high-dimensional  time-energy  encoding  demonstrated  here  offers  the  ability  to  optimize 
the  secret-key  rate  by  varying  the  alphabet  size  M  in  response  to  both  channel  loss  and  receiver 
limitations.  This  is  particularly  useful  when  Bob’s  detectors  are  saturated,  which  often  occurs 
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over  metropolitan-area  distances  of  tens  of  kilometers.  By  presenting  and  demonstrating  a 
protocol  intended  to  adapt  to  the  constraints  of  a  particular  link  implementation,  this  work 
represents  a  new  approach  to  high-rate  secure  quantum  communication  optimized  for  use  in 
metropolitan  areas. 

Materials  and  Methods 

The  deployed-fiber  testbed  comprised  a  pair  of  dark  fibers,  one  of  which  is  used  for  quantum 
signals,  and  the  other  of  which  is  used  for  bright  synchronization  pulses.  Alice’s  light  source 
was  a  superlumine scent  diode  with  tens  of  nanometers  of  optical  bandwidth.  This  source  can 
enable  DO-QKD  with  multiple  spectral  channels,  although  this  demonstration  used  only  one 
channel  with  25  GHz  of  optical  bandwidth,  filtered  by  a  tunable  bandpass  filter.  The  25  GHz 
output  was  modulated  by  an  electro-optic  modulator  with  a  PPM  sequence  of  50  ps  pulses 
centered  in  240  ps  time  slots  that  was  produced  by  a  pulse  pattern  generator  (PPG).  The  resulting 
optical  pulses  were  attenuated  to  either  //  =  0.5  photons/pulse  for  signal  states  or  v  =  0.05 
photons/pulse  for  decoy  states.  A  circulator  at  the  output  of  Alice’s  transmitter  (not  pictured 
in  Fig.  2)  provided  some  protection  against  a  Trojan  horse  attack.  The  bright  synchronization 
pulse  was  produced  by  a  continuous-wave  laser  modulated  by  an  electro-optic  modulator  driven 
by  another  output  of  the  same  PPG.  The  synchronization  pulse  period  was  a  constant  multiple 
of  the  symbol  frame  length.  In  the  back-to-back  and  spool  tests,  the  period  was  256  times  the 
symbol  frame  length  for  all  M.  For  the  deployed- fiber  test,  the  period  was  reduced  to  64  times 
the  symbol  frame  length  to  mitigate  the  effects  of  timing  drifts  over  the  installed  fiber. 

Following  the  signal  exchange  and  measurement  step,  the  classical  postprocessing  —  error 
reconcilation  and  privacy  amplification  —  was  performed  offline.  Because  only  one  SNSPD 
system  was  available,  Bob  could  not  randomly  choose  between  the  two  measurement  bases. 
Therefore,  we  fixed  both  Alice  and  Bob’s  basis  selections  for  the  duration  of  each  data  ac- 
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quisition  period.  The  resulting  datasets  were  combined  in  postprocessing.  For  each  test  case, 
numerical  optimization  of  the  secret-key  rate  determined  the  probabilities  with  which  Alice  and 
Bob  should  have  selected  each  basis;  the  data  from  different  bases  were  combined  using  these 
probabilities  to  compute  the  reported  experimental  secret-key  rates.  Similarly,  Alice’s  choice  of 
signal  or  decoy  intensity  was  fixed  for  the  duration  of  each  acquisition  period,  the  probabilities 
with  which  Alice  selected  signal  or  decoy  states  were  determined  by  numerical  optimization  for 
each  test  case,  and  the  data  from  different  intensities  were  combined  using  these  probabilities 
in  postprocessing. 
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Back-to-back 

41  -km  spool 

43 -km  deployed  fiber 

Loss  (dB) 

0.1 

7.6 

12.7 

Slot  duration  (ps) 

240 

240 

240 

Optimal  M 

16 

8 

4 

Max.  secret-key  rate  (bps) 

23  x  106 

5.3  x  106 

1.2  x  106 

Secure  PIE  (bit/photon) 

1.40 

0.88 

0.50 

Symbol-error-rate  (SER) 

0.065 

0.048 

0.049 

Table  1:  Summary  of  the  maximum  secret-key  rates  obtained  in  the  three  test  cases. 
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Figure  1:  (a)  In  high-dimensional  temporal  encoding  (pulse  position  modulation),  information 
is  encoded  in  the  position  of  an  optical  pulse  within  M  slots,  depicted  here  for  alphabet  size 
M  £  {2, 4,  8, 16}.  For  a  fixed  slot  duration,  the  alphabet  size  and  the  transmitted  pulse  rate 
are  inversely  proportional,  (b)  Representative  plot  of  secret-key  rate  versus  channel  length  for 
a  traditional  two-dimensional  QKD  protocol,  assuming  a  5  Gbps  modulation  rate,  a  0.2  dB/km 
channel  loss,  a  1  kcps  background  count  rate,  a  93%  detector  efficiency,  and  a  100  ns  detector 
reset  time  after  each  detection  event.  Three  regions  are  denoted:  I.  At  short  distances,  0-100  km 
(or  correspondingly,  low  losses,  0-20  dB),  the  secret-key  rate  is  limited  by  detector  saturation. 

II.  For  higher  losses  (normal  operation),  the  secret-key  rate  decays  exponentially  with  distance. 

III.  At  even  higher  losses  (>  300  km),  a  cutoff  is  reached  when  Bob’s  received  photon  rate 
becomes  comparable  to  his  detectors’  background  count  rate.  The  error  rate  grows  and  the 
secret-key  rate  drops  abruptly. 
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Figure  2:  Map  showing  node  locations  and  approximate  path  of  the  installed  43-km  deployed- 
fiber  testbed  used  in  this  work.  Overlaid  are  Alice’s  transmitter,  located  in  Cambridge,  MA, 
and  Bob’s  receiver,  located  in  Lexington,  MA.  BPF:  bandpass  filter.  EOM:  electro-optic  mod¬ 
ulator.  VOA:  variable  attenuator.  ND:  normal  GVD.  AD:  anomalous  GVD.  DCF:  dispersion- 
compensating  fiber. 
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Figure  3:  (a)  Experimental  (stars)  and  theoretical  (dashed  curves)  secret-key  rates  versus  chan¬ 
nel  loss.  Colors  correspond  to  optimal  alphabet  size  M  for  each  of  the  three  test  configurations. 
Each  theoretical  curve  uses  a  different  set  of  experimental  parameters  (e.g.,  detector  timing  jit¬ 
ter)  that  corresponds  to  each  of  the  test  configurations:  Exp.  config  A  =  Back-to-back;  exp. 
config.  B  =  spool;  exp.  config.  C  =  deployed  fiber,  (b)  Experimental  secret-key  rates  for  all 
alphabet  sizes  of  each  test  case.  Loss  increases  from  left  to  right.  The  optimal  M  decreases 
as  loss  increases.  For  experimental  convenience,  we  did  not  increase  the  alphabet  size  once  it 
became  apparent  that  doing  so  would  not  increase  the  secret-key  rate. 
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Figure  4:  Comparison  of  our  P&M  DO-QKD  results  to  previously  published  QKD  system 
records,  chosen  to  represent  either  secure  throughput  or  distance  records  for  a  variety  of  pro¬ 
tocols.  BB84/T12:  secure  throughput  record  for  two-dimensional  QKD  (1).  HD-QKD:  secure 
throughput  record  for  high-dimensional  entanglement-based  QKD  (11).  MDI-QKD:  secure 
throughput  record  for  measurement-device-independent  QKD  (39).  CV/GMCS:  distance  record 
for  continuous-variable  QKD  (40).  BBM92:  secure  throughput  record  for  two-dimensional 
entanglement-based  QKD  (41).  COW:  distance  record  for  QKD  (20). 
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